Clement Lecigne 56b88b5056 ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF ... Takes rwsem lock inside snd_ctl_elem_read instead of snd_ctl_elem_read_user like it was done for write in commit 1fa4445f9a ("ALSA: control - introduce snd_ctl_notify_one() helper"). Doing this way we are also fixing the following locking issue happening in the compat path which can be easily triggered and turned into an use-after-free. 64-bits: snd_ctl_ioctl snd_ctl_elem_read_user [takes controls_rwsem] snd_ctl_elem_read [lock properly held, all good] [drops controls_rwsem] 32-bits: snd_ctl_ioctl_compat snd_ctl_elem_write_read_compat ctl_elem_write_read snd_ctl_elem_read [missing lock, not good] CVE-2023-0266 was assigned for this issue. Cc: stable@kernel.org # 5.13+ Signed-off-by: Clement Lecigne <clecigne@google.com> Reviewed-by: Jaroslav Kysela <perex@perex.cz> Link: https://lore.kernel.org/r/20230113120745.25464-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>		2023-01-13 14:15:26 +01:00
..
oss	ALSA: pcm: Avoid reference to status->state	2022-09-27 08:44:05 +02:00
seq	ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event	2022-11-19 09:20:11 +01:00
Kconfig	ALSA: control: Add input validation	2022-06-15 07:45:28 +02:00
Makefile	m68k: coldfire: drop ISA_DMA_API support	2022-05-16 13:18:30 +10:00
compress_offload.c	ALSA: compress: Fix kernel doc warnings	2022-07-13 13:42:36 +02:00
control.c	ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF	2023-01-13 14:15:26 +01:00
control_compat.c	x86: Remove toolchain check for X32 ABI capability	2022-03-15 10:32:48 +01:00
control_led.c	ALSA: control-led: use strscpy in set_led_id()	2023-01-09 17:03:24 +01:00
ctljack.c	ALSA: Convert strlcpy to strscpy when return value is unused	2021-01-08 09:30:05 +01:00
device.c	ALSA: core: Fix missing return value comments for kernel docs	2022-07-13 13:42:38 +02:00
hrtimer.c	ALSA: timer: Replace tasklet with work	2020-09-09 18:32:52 +02:00
hwdep.c	ALSA: core: Fix assignment in if condition	2021-06-09 17:30:22 +02:00
hwdep_compat.c	ALSA: compat_ioctl: avoid compat_alloc_user_space	2020-09-21 10:37:07 +02:00
info.c	ALSA: info: Fix llseek return value when using callback	2022-08-17 15:13:30 +02:00
info_oss.c	ALSA: oss: remove useless NULL check before kfree	2021-12-06 10:08:13 +01:00
init.c	ALSA: core: Fix double-free at snd_card_new()	2022-09-19 14:36:06 +02:00
isadma.c	sound updates for 6.0-rc1	2022-08-06 10:19:51 -07:00
jack.c	ALSA: jack: Access input_dev under mutex	2022-04-12 12:19:05 +02:00
memalloc.c	ALSA: memalloc: don't use GFP_COMP for non-coherent dma allocations	2022-12-21 08:45:17 +01:00
memalloc_local.h	ALSA: memalloc: remove snd_dma_sg_ops declaration	2022-09-09 09:09:40 +02:00
memory.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156	2019-05-30 11:26:35 -07:00
misc.c	ALSA: core: Add async signal helpers	2022-07-29 12:57:10 +02:00
pcm.c	ALSA: pcm: Avoid reference to status->state	2022-09-27 08:44:05 +02:00
pcm_compat.c	ALSA: pcm: Avoid reference to status->state	2022-09-27 08:44:05 +02:00
pcm_dmaengine.c	ALSA: dmaengine: increment buffer pointer atomically	2022-09-27 08:55:05 +02:00
pcm_drm_eld.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
pcm_iec958.c	ALSA: iec958: Split status creation and fill	2021-06-08 17:05:41 +02:00
pcm_lib.c	ALSA: pcm: Avoid reference to status->state	2022-09-27 08:44:05 +02:00
pcm_local.h	ALSA: memalloc: Support for non-contiguous page allocation	2021-10-18 13:32:10 +02:00
pcm_memory.c	ALSA: pcm: Fix missing return value comments for kernel docs	2022-07-13 13:42:34 +02:00
pcm_misc.c	ALSA: pcm: Test for "silence" field in struct "pcm_format_data"	2022-04-11 09:27:56 +02:00
pcm_native.c	ALSA: pcm: Handle XRUN at trigger START	2022-12-05 14:22:48 +01:00
pcm_param_trace.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
pcm_timer.c	ALSA: timer: Constify snd_timer_hardware definitions	2020-01-03 09:24:07 +01:00
pcm_trace.h	ALSA: pcm: fix tracing reason in hw_ptr_error	2022-11-28 14:55:41 +01:00
rawmidi.c	ALSA: rawmidi: remove variable dest_frames	2022-10-24 16:01:05 +02:00
rawmidi_compat.c	ALSA: rawmidi: Add framing mode	2021-05-17 16:02:44 +02:00
seq_device.c	ALSA: seq: Fix a potential UAF by wrong private_free call order	2021-09-30 14:13:22 +02:00
sound.c	ALSA: core: Fix assignment in if condition	2021-06-09 17:30:22 +02:00
sound_oss.c	ALSA: oss: Fix potential deadlock at unregistration	2022-10-11 09:02:43 +02:00
timer.c	ALSA: timer: Use deferred fasync helper	2022-07-29 12:57:11 +02:00
timer_compat.c	ALSA: Convert strlcpy to strscpy when return value is unused	2021-01-08 09:30:05 +01:00
vmaster.c	ALSA: core: Fix missing return value comments for kernel docs	2022-07-13 13:42:38 +02:00